Fake computer account authentication attempt

Description

'This query detects authentication attempt from a fake computer account(username ends with $). Computer accounts are normally not authenticating via interactive logon or remote desktop neither they are unlocking the systems.'

Query · kql

SecurityEvent
  | where TargetUserName endswith "$" and EventID in (4624,4625) and LogonTypeName in (2,7,10)
  | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated) by EventID, Computer, TargetUserName, TargetLogonId, LogonTypeName, IpAddress
Raw source Fake computer account authentication attempt · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: f68084a2-87eb-11ec-a8a3-0242ac120002
name: Fake computer account authentication attempt
description: |
   'This query detects authentication attempt from a fake computer account(username ends with $). 
   Computer accounts are normally not authenticating via interactive logon or remote desktop neither they are unlocking the systems.'
requiredDataConnectors:
  - connectorId: SecurityEvents
    dataTypes:
      - SecurityEvent
tactics:
  - DefenseEvasion
relevantTechniques:
  - T1564
query: |
  SecurityEvent
    | where TargetUserName endswith "$" and EventID in (4624,4625) and LogonTypeName in (2,7,10)
    | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated) by EventID, Computer, TargetUserName, TargetLogonId, LogonTypeName, IpAddress

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.